The renderer keeps raw HTML and does not check link schemes. Either drop a tag (<img src=x onerror=alert(document.domain)>) or a poisoned link ([click](javascript:alert(document.domain))).
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only